Twelve Tricks

Computer malware reported in 1990

Twelve Tricks is a Trojan horse that first appeared around 1990.

Purdue University issued a bulletin about the Trojan on March 8, 1990.^[1] The Trojan came in an altered utility file called CORETEST.COM, which was intended to test performance of hard drives. It affected IBM platform computers running MS-DOS or PC DOS. The Trojan alters the master boot record (partition sector) and, at every reboot, it installs one of twelve "tricks" that causes issues with hardware or operation of the computer. The trick vanishes when the power is cut off, and any of the twelve tricks may appear or reappear on the next reboot. In addition, on each boot the Trojan uses a random number generator to determine whether to do a low-level format of the active copy of the boot sector and the first copy of the FAT; there is a 1/4096 chance of this happening. If the format does not happen, the Trojan randomly changes one random word in any of the first sixteen sectors of the FAT, leading to a gradual corruption of the file system.